CVE-2023-4842
MEDIUMSocial Warfare <= 4.4.3 - Authenticated Stored XSS via 'social_warfare' Shortcode
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2023-4842. PoCs published by B4ntGrim.
AI-analyzed exploit summary This repository contains a detailed penetration test report documenting the exploitation of CVE-2019-9978 and CVE-2023-4842 to achieve unauthenticated Remote Code Execution (RCE) and establish a persistent Meterpreter session. The report includes methodology, findings, and remediation recommendations.
Description
The Social Sharing Plugin - Social Warfare plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'social_warfare' shortcode in versions up to, and including, 4.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Exploits (1)
This repository contains a detailed penetration test report documenting the exploitation of CVE-2019-9978 and CVE-2023-4842 to achieve unauthenticated Remote Code Execution (RCE) and establish a persistent Meterpreter session. The report includes methodology, findings, and remediation recommendations.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N